# OAuth access tokens get HTTP 500 "Unknown error" on POST /dataset/{project}/upload

**URL:** <https://discuss.roboflow.com/t/oauth-access-tokens-get-http-500-unknown-error-on-post-dataset-project-upload/12552>\
**Category:** 🛠️ Feature Reqs\
**Tags:** bugs\
**Created:** [October 8, 2026, 1:52pm UTC](https://discuss.roboflow.com/t/oauth-access-tokens-get-http-500-unknown-error-on-post-dataset-project-upload/12552 "2026-10-08T13:52:40Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![pnewell4](https://yyz1.discourse-cdn.com/flex029/user_avatar/discuss.roboflow.com/pnewell4/32/6376_2.png) [@pnewell4](https://discuss.roboflow.com/u/pnewell4)\
**Post date:** [October 8, 2026, 1:52pm UTC](https://discuss.roboflow.com/t/oauth-access-tokens-get-http-500-unknown-error-on-post-dataset-project-upload/12552/1 "2026-10-08T13:52:40Z")

</div>

I’m building a native iOS app that authenticates with Roboflow OAuth (PKCE public client, `rfoa_` access tokens). Reads, model downloads, and `/{workspace}/{project}/upload/zip` all accept the token, but the single-image upload endpoint crashes:

`curl -X POST -H 'Authorization: Bearer rfoa_x' https://api.roboflow.com/dataset/p/upload`

returns HTTP 500 `{"error":"Unknown error"}` for any `rfoa_` token (valid or fake), whatever the body: base64, multipart, or `image=` URL. The same token passed as `?api_key=` does the same thing. A non-OAuth fake key gets the normal 401, and other routes like `/annotate` and `/upload/zip` correctly return 401 “This OAuth token is invalid or expired” for a bad OAuth token. The docs and OpenAPI spec say OAuth tokens work on this route. Is this a known issue, or is OAuth not meant to cover single-image upload?

fwiw, I prefer the zip upload and have switched to it, but I originally coded using an API key and the single-image upload. so, this is simply an FYI.

thanks!